Privacy policy
Compliant with the General Data Protection Regulation (GDPR — EU 2016/679) and the amended French Data Protection Act.
1. Data controller
The controller of your data is RGL SARL (Nonna Luisa Food Service), 2 rue Massena 06000 Nice, SIRET 808 745 152 00013. Contact: info@lanonnaluisa.com.
2. Data collected
We only collect the data strictly necessary to deliver our services:
- Company identity : company name, SIRET, intra-EU VAT, activity type, address
- Contact : email, phone, contact name
- Authentication : email + hashed password
- Order history : ordered products, amounts, dates, delivery addresses
- Payment : card data does not transit through our servers, it is processed directly by Stripe (PCI-DSS Level 1)
- Browsing : strictly necessary technical cookies (cart, session)
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account creation and client management | Performance of the contract |
| Order processing and deliveries | Performance of the contract |
| Invoicing and accounting | Legal obligation |
| SIRET and VAT verification (data.gouv, VIES) | Legal obligation + legitimate interest |
| Commercial information (email) | Consent / B2B legitimate interest |
| Fraud prevention | Legitimate interest |
4. Recipients and processors
Your data is shared only with the strictly necessary recipients:
- Partner workshop (Cortemilia, Piemonte) (Italy): shipping address and order contents, solely for shipment
- Stripe Payments Europe: payment data (Ireland)
- Brevo (formerly Sendinblue): email + name for transactional emails (France)
- Supabase: database hosting (EU)
- Vercel & Railway: application hosting (USA, DPF framework)
- Accountant: invoicing data (France)
All our processors are contractually bound to comply with the GDPR.
5. Retention period
- Account data: duration of the commercial relationship + 3 years after inactivity
- Invoices and accounting: 10 years (legal obligation)
- Commercial prospecting: 3 years after last contact
- Technical logs: 12 months maximum
6. Your rights
Under the GDPR, you have the following rights on your data:
Obtain a copy of your data
Correct inaccurate data
Right to be forgotten (subject to legal limits)
Freeze a contested processing
Recover your data in a standard format
Refuse a processing based on legitimate interest
To exercise these rights, write to info@lanonnaluisa.com with proof of identity. We reply within 30 days.
You may also file a complaint with the French CNIL (www.cnil.fr).
7. Cookies
We only use strictly necessary cookies for the site to work (user session, cart). No third-party advertising or analytics cookies are dropped without your consent. You can configure them via your browser settings.
8. Security
We implement appropriate technical and organisational measures to protect your data: TLS encryption for all communications, hashed passwords (bcrypt), strict access control, regular backups, environment separation, active monitoring.
9. Changes
This policy may be updated to reflect regulatory or technical evolutions. The last update date is shown at the bottom. In case of substantial change, we will inform you by email.